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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

Eastern District of Virginia 


In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ) 

THE PREMISES LOCATED ^ 
ALEXANDRIA, VIRGINIA 22314 ) 

) 


Case No. 1:17SW449 

UNDER SEAL 


SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 

of the following person or property located in the _ Eastern District of_ Virginia 

(identify the person or describe the property to be searched and give its location)\ 


See Attachment A 


I find that the affidavits), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized)'. 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before 


August 8, 2017 


(not to exceed 14 days) 


ijf in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to__ Honorable Theresa C. Buchanan _. 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for (/ffl days (not to exceed 30) □ until, the facts justifying, the later specific date of _ 


Date and time issued: g )j) j | 'Jj _ [ | ( 

City and state: Alexandria, Virginia _ 



There 


7s/ 


heresa_5arroli Buchanan 
eflS tales Magistrate ind 


Judge's signature 

Honorable Theresa C. Buchanan 


Im¬ 


printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 



Case No.: 

1:17SW449 

Date and time warrant executed: . 

iMzvt/ 

Copy of warrant .and inventory left with: 

Paul 

Inventory made in the presence of: ‘ it/ P 

fctUsl A J WUPC*0+''t 


L>gf i^e/hs sensed 


I'iCKcb 


a-> g rv-f- 


<s> (_ i £ 4 ^ cP^ )Anc\a £cl } /) 0 -f- p ^ £ i CL 4. I lu^ -r*lken 

<p£_vSt of ii~£ /l -L5 )^ C '$sj ec ^ ^° r poSSih/tL 

c pr n/tlgqe (A+feth ^eo~t C ^ 


Certification 


I declare under penalty of peijury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Date: 



iiUUMU&Mtl 



signature 
£ p£C i\J 


.f'l t 


Printed name and title 
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FD-597 (Rev 8-11-94) 


Page 1 of 4 



UNITED STATE DEPARTMENT OF JUSTICE 
FEDERAL BUREAU OF INVESTIGATION 

Receipt for Property Received/Returned/Released/Seized 



On (date) 7/26/2017 


(Name) Paul Manafort 

(Street Address) 

(City) Alexandria, VA 22314 


item(s) listed below were: 

□ Received From 

□ Received To 

□ Released To 
£><] Seized 


Description of ltem(s): 

Financial documents, calenders, list of passwords 
Business agreement 

Papers with e-mail addresses, handwritten notes, letter from | 
financial Institutions 


:orrespondence, envelopes from 


Capital One statement + deposit acc 
One deposit acct# 


Capital One statement + deposit acct 


Capital 


M+T Bank Acct 


+T Bank Acct 


Various banking deposit slips from Citibank, Weils Fargo, acct statements Citigold acct 
acct statements Citigold acctA^^^^ 

Handwritten list of contacts 

Hudson City Savings Bank Acct#H^^^^ Hudson City Savings Bank Acct#|HI^^B 
Transaction Register: "Capital One", Transaction Register: "Opened Mar 20,2013", Transaction Register: 


transfer + 


Capital One brokerage statement acc 
First Repub. Bank acct statement: 


Capital One acct. profile + agreement acct: 
First Repub. Bank acct statement: 


Nine (9) green hanging file folders containing financial and other documents 
Thirteen (13) green hanging file folders containing documents 
Safety deposit key number 55 with envelope labeled "CCFSB" 

1 Citibank banking document, handwritten notes on yellow lined paper, with envelope "Davis, Manafort Inc 

Virginia 

4 Capitol One banking documents with envelope "Hudson M&T savings" 
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FD-597 (Rev 8-11-94) 


Page 2 of 4 

UNITED STATE DEPARTMENT OF JUSTICE 
FEDERAL BUREAU OF INVESTIGATION 

Receipt for Property Received/Returned/Released/Seized 


File 

Eight (8) documents from hanging file drawer #4, plus one (1) green hanging file 


Seven (7) green and five (5) brown hanging file folders containing documents. 
Check for USB acctSHHI 


One (1) deposit slip, Two (2) documents from Charles Schwab re: closure of accounts; one addressed to Paul 
Manafort, one addressed to 


Pack of 4 DVD discs, "Hyatt Regency Kyiv" notepaper used to make handwritten notes mentioning "laptop", 
"flashdrin", "and "disc" 


1 black external hard drive "simpletech" logo. SN: unknown; BOM No: 


1 Blue external hard drive - "WD" logo SN: 


American Express Business Platinum, 



Ramshead Farm 


UBS Visa, ending in|H UBS Visa, Ramshead Farms LLC Paul Manafort, ending in|| 

UBS Visa, LOAV LTD Paul J. Manafort, ending inHH UBS Visa, John Hannah LLC Paul J. Manafort, ending In 


S10, drawer two; including financial documents. Box 2 of 2. 

S10, drawer three, including real estate, inheritance, investment, tax, retirement and art purchase documents 

S10, drawer one, including financial and real estate document 

S10, drawer two; including real estate and financial documents. Box 1 of 2. 

Twenty (20) documents containing financial + other information, located in Charles Schwab folder on built-in 
library shelf _ 

Financial document 

1 black watch, labeled "The Royal Way, Bijan, N03" 

512 MB Sandisk SD Card from Nikon Cool Pics FN-1 located in black case in black/red camera/video bag 
32GB Transcend SD card located in Go Pro Hero 2 from black bower camera bag 
18G Transcend SD card; 132GB SD card Nikon D-7000 located in black/red Tamrac camera bag 
1GB Sandisk card from Casio EXILIM camera from gray mesh bag 
Black Sony stick 32GB located in a Sony camera from black Lo Pro bag 

16GB San Dis k SD Card from Nikon D-90 located in black Nikon camera bag _ 

Micro SD 64G - found in Nikon I camera from bright green Tumi camera bag 

... - . - . , - . -.- - .... .-.. - ■ . — . ...— - --.- ■ ---- 

16 GB Sandisk SD card from Nikon Cool Pics S-9700 located in bright green Tumi camera bav 
116GB Sony memory stick pro located in Sony handicam from Sony leather handicam case in clear ziploc 
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FD-597 (Rev 8-11-94) 


Page 3 of 4 


UNITED STATE DEPARTMENT OF JUSTICE 
FEDERAL BUREAU OF INVESTIGATION 

i Receipt for Property Received/Returned/Released/Seized 


File#: 





iPod, 64 GB, SN: _ 

32GB Transcend 32GB SD card located in Panasonic HCV700M video camera + black/red video bag 

2 16MB Lexar compact flash cards; 1 Viking 128MB compact flash card; 1 San Disk 4GB SD card; 1 San Disk 
256MB memory stick; 18MB Sony mega memory stick; 1G4 MB Sony memory stick; 116GB Sony memory stick 

2GB Polaroid SD card located in Casio camera 

8GB Sony memory stick located in Sony cyber shot in black pouch + black mesh bag 
Lexar 1GB SD card located in Casio EX-Z1200, in black mesh bag 
4 GB memory stick, Sony, located in Sony cyber shot in black Sony pouch 
4GB San Disk SD card located in Canon power shot XS210 in black camera bag 

G Drive Slim, 50QGB; SNgJJg _ 

RMK_MacBook__Air_Western Digital WD7500BPKX-00HPJT0 750GB hard drive, S/N containing 

memory dump and image of a 500GB solid state drive from an Apple MacBook Air model A1466, S/N 


in black case 


Western Digital external hard drive, SN: 

4 Citibank financial documents 

2 M&T banking statements (accts.^BI an ^j^HH Capital One brokerage statement (accts ~H|, 2 
property tax assessments (Land Rover Financial Group) 

iPad - 64GB SN: _ 

iomega hard drive; model 31905000; SN: 

Mobile Mate SD+ memory card reader - San disk; Memorex 8GB MegaTravel Drive, w/case - in Ziploc bag 
iomega hard drive; model# 31847300 SN: 

(6) Six blue thumbdrives; (2) Two pinkthumbdrives 

HP Mobile USB Drive; Kit#D0549A, Drive Spare #348648-001 Cable Spare #348649-001 ___ 

Seagate Go Flex hard drive S/N: 
iPad - 64GB serial#: 
iPhone in black and orange case IMEI: 

Sony micro vault pro - 5GB SN: 

DEWF_COMB01: A 1TB HGST HDD, S/N:( 
from rooms: C, F, K, and Q 

5 UBS checks from 5 different accounts 


located in blue case 

containing forensic images and device extractions 
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FD-597 (Rev 8-11-94) 


Page 4 of 4 

UNITED STATE DEPARTMENT OF JUSTICE 
FEDERAL BUREAU OF INVESTIGATION 

Receipt for Property Received/Returned/Released/Seized 


6 blank deposit slips from various banks, 7 check reorder forms from various banks, 1 top page of Merrill Lynch 
checkbook 


Financial records _ 

Documents of personal letters, vehicle information, e-mail information, contact information. Politico article 
"Mystery Man: Ukraine's U.S. Political Fixer." 


iomega portable hard drive 1TB SN 



Documents and seal for JESAND, LLC 


Life insurance policy information from Northwestern Mutual 
Estimates and/or quotes of high dollar items from Mallett, Inc. 
Art records and financial records and home appraisals 


Received By 



Received From Paul Manafort 


(signature) 


(signature) 
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ATTACHMENT B 

List of items digitally imaged on-premises, not physically taken: 







RMC IPOD TOUCH - Apple iPod Touch 8 Gigabyte (GB) 4th Generation, Model: A1367, 
MC540LL/A, Serial Number (S/N): ^BHH^H A file system and logical extraction 

was made. __ 

RMF IMAC - Apple iMac (27-inch, Mid 2011), Model: A1312, S/N: 

EMC No: 2429 co ntaining a 250 GB Apple Solid State Drive (SSD), Model: TS256C, S/N: 
BBHHHH an ^ a 1 TB Western Digital Ha rd Disk Drive (HDD), Model: 
WD1001FALS-403AA0, S/N date and time of the device was 

accurate. The owner supplied the passwordT^^^B was usec * t0 gain access to the 
computer and the WiFi networking was turned off at approximately 7:29 AM. A memory 
capture was made of the running computer. No encryption was detected on the internal 
HDDs. 


RMFJPHONE7 - Black Apple iPhone 7 32 GB, Model: A1660 / MNAC2LL/A, S/N: 


IMEI: MEID: 

i 11111 mi. 1 mi mi ii i .IN 10.2.1 

(14D27). There was no Apple ID associated with the phone. The phone name is: iPhone. A 
file system and logical extraction was made of the phone and a logical extraction was made 
of the SIM card. 


BBHB MEID: 
running IOS 10.2.1 


RMF IPOD TOU CH1 - Apple iPod T ouch 8 GB 4th Generation, Model: A1367, 
MC540LL/A, S/N: A file system and logical extraction was made. 

RMFJPOD_TOU CH2 - Apple iPod Touch 8 GB 4th Generation, Model: A1367, 
MC540LL/A, S/N: BHBliH^I A file system and logical extraction was made. 
RMFJPOD - Apple iPod 160 GB, model: A1238, S/N: ^BHH^I A forensic image 
was made. Note: The forensic image was inadvertently named the same as RMF FLASH10. 
RMFSDCARD - 512 MBLexar Platinum SD card, Model: 3401-512SA 4505C, Universal 

Serial Bus (USB) S/N: ^^B A forensic image was made. _ 

RMF FLASH2 - 32 GB Monster Digital Flash Drive, USB S/N: A 

forensic image was made. _ 

RMF FLASH3 - 4 GB Silver and Clear Flash Drive, USB S/N: IBII^I A forensic image 

was made. _ 

RMF FLASH4 - 8 GB Generic Blue Colored Flash Drive, USB S/N: BBIA forensic 

image was made. _ 

RMF FLASH5 - 8 GB Generic Blue Colored Flash Drive, USB S/N: BI^^H A forensic 

image was made. _ 

RMF-FLASH6 - 8 GB Generic Blue Colored Flash Drive, USB S/N: A forensic 

image was made. _ 

RMF-FLASH8 - 64 Megabyte (MB) Dell Flash Drive, USB S/N: BB^HHHH A 

forensic image was made. _ 

RMF-FLASH9 - 8 GB Generic Blue Colored Flash Drive, USB S/N: ^^BHI A forensic 
image was made. 

RMF-FLASH10 - 4 GB Highcountry Investments Limited Flash Drive, no S/N. A forensic 
image was made. 
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RMF-FLASH11 - 8 GB Generic Blue Colored Flash Drive, USB S/N: A forensic 

image was made. 

RMF-FLASH12 - 8 GB Generic Blue Colored Flash Drive, USB S/N: A forensic 

image was made. 


RMF-FLASH13 - 1 GB Blue KWC Flash Drive, no S/N. A forensic image was made. 

RMK MACBOOK^AIR - Apple Macbook Air (13-inch, Early 2015), Model: A1466, S/N: 

EMC No: 2925 containing a 500 GB Apple SSD, Model: SM0512G, S/N: 
The owner entered the password to unlock the computer. The internal 
SSD was Apple Filevault encrypted. A memory capture was made of the running computer. 

A decrypted image of the computer was made. 

RMKJPHONE7 - White Apple iPhone 7 32 GB, Model: A1660 / MN8J2LL/A, S/N: 


■■I MEID: 
running IOS 10.3.2 


IMEI: MEID: 

containingAT&TSIM-^^^(P^^^^^^^^^mnning IOS 10.3.2 
(14F8 9). The Apple ID associated w ith the phoneis^^^^^^UlB e “ 
mail: H|^mmmmB|^Vrhe phone name is: KBM AT&T. A file system and 
logical extraction was made of the phone and a logical extraction was made of the SIM card. 
RMKIPHONE7PLUS - Jet Black Apple iPhone 7 Plus 256GB, Model: A1661 / 


MN4L2LL/A, S/N: IMEI: ICCID: 

|H^^HH^^HH^HMEID!^^^B^^^^|containirigAT&T SIM: 
^^^^^|^^^^^^^Uunrun^O^O^T^14F89)^ie Apple ID associated with the 
phone is paul manafort, phone name is: Channel 3. A 

file system and logical extraction was made of the phone and a logical extraction was made 
of the SIM card. 


IMEI: 


MEID: 


phone is paul manafort, 


RM KIP ADMINI1 - Bla ck Apple iPad Mini with R etina D isplay 32 GB, Model: A14 90, 
S/N: ^^^^^^HMSISDN: ■■■lCCIDj^H^p|| 

IMSlT^^H^^B containing Verizon SIM?]^|^^^H^H|mrumiingIOS 
10.3.2 (14F89). The Apple ID associated with the table is paul manafort, e-mail: 

tables name is: iPad. A file system and logical extraction was 
made of the tablet and a logical extraction was made of the SIM card. 

RMK IPAD MINI2 - Wh ite App le iPad Mini 64 GB , Model A1455, S/N: 
IMEE^^^^^P MEID: containing Verizon SIM: 

runnin^OS^L^12B440)^he Apple ID associated with the 
tablet is paul manafort, e-mail: table name is: Paul IPAD Mini. 

A file system and logical extraction was made of the tablet and a logical extraction was made 
of the SIM card. 


RMK IPOD TOU CH1 - Apple iPod T ouch 8 GB 4th Generation, Model: A1367, 
MC540LL/A, S/N: A file system and logical extraction was made. 

RMK IPQD TOU CH2 - Apple iPod T ouch 8 GB 4th Generation, Model: A1367, 
MC540LL/A, S/N: A file system and logical extraction was made. 

RMK_CAMERA_MICROSD - 4 GB Toshiba Micro SD HC memory card from an Olympus 
digital camera, model: Stylus Tough-6000, S/N: A forensic image was made. 

RMK SONYCAMERA SDCARD - 4 GB S ony SD H C memory card from a Sony Cyber¬ 
shot digital camera, model: DSC-WX5, S/N: A forensic image was made. 

RMK FLASH1 - 512 MB SanDisk Cruzer Micro. A forensic image was made. 

RMK FLASH2 - 8 GB Generic Blue Colored Flash Drive. A forensic image was made. 
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RMQ_CAMCORDER SDCARD1 - 32 GB SanDisk Ultra SD HC memory card from Slot A 
of a Canon VIXIA HF G30 camcorder. A forensic image was made. 
RMQ_CAMCORDER_SDCARD2 - 64 GB SanDisk Ultra SD XCI memory card from Slot 
B of a Canon VIXIA HF G30 camcorder. A forensic image was made. 
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ATTACHMENT A 
The Property to Be Searched 

The premises to be searched (the' “Subject Premises”) is the condominium unit located at 

Alexandria, VA 22314, including the storage unit numbered | 
Hi as well as any locked drawers, containers, cabinets, safes, computers, electronic devices, and 
storage media (such as hard disks or other media that can store data) found therein. 
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ATTACHMENT B 


Items to Be Seized (or, in the alternative, identified) 

1. Records relating to violations of 31 U.S.C. §§ 5314, 5322(a) (failure to file a report 
of foreign bank and financial accounts); 22 U.S.C. § 611, et seq . (foreign agents registration act); 
26 U.S.C. § 7206(1) (filing a false tax return); 18 U.S.C. § 1014 (fraud in connection with the 
extension of credit); 18 U.S.C. §§ 1341, 1343, and 1349 (mail fraud, wire fraud, and conspiracy to 
commit these offenses); 18 U.S.C. §§ 1956 and 1957 (money laundering and money laundering 
conspiracy); 52 U.S.C. §§ 30121(a)(1)(A) and (a)(2) (foreign national contributions); and 18 
U.S.C. §§371 and 2 (conspiracy, aiding and abetting, and attempt to commit such offenses) 
(collectively, the “Subject Offenses”), occurring on or after January 1, 2006, including but not 
limited to: 

a. Any and all financial records for Paul Manafort, Jr., ^^^f^^HH^Richard 

Gates, or companies associated with Paul Manafort, or 

Richard Gates, including but not limited to records relating to any foreign financial 
accounts and records relating to payments by or on behalf of any foreign 

government, foreign officials, foreign entities, foreign persons, or foreign 

principals; 

b. Any and all federal and state tax documentation, including but not limited to 
personal and business tax returns and all associated schedules for Paul Manafort, 
Jr., Richard Gates, or companies associated with Manafort or Gates; 

c. Letters, correspondence, emails, or other forms of communications with any 
foreign financial institution, or any individual acting as the signatory or controlling 
any foreign bank account; 

d. Records relating to efforts by Manafort, Gates, or their affiliated entities to conduct 

activities on behalf of, for the benefit of, or at the direction of any foreign 

government, foreign officials, foreign entities, foreign persons, or foreign 

principals, including but not limited to the Party of Regions and Viktor 
Yanukovych; 

e. Records relating to, discussing, or documenting Telmar Investments Limited, 
Tiakora Ventures Limited, Lucicle Consultants Limited, Actinet Trading Limited, 
Black Sea View Limited, Bletilla Ventures Limited, Evo Holdings Limited, Global 
Highway Limted, Leviathan Advisors Limited, Loav Advisors Limited, Peranova 
Holdings Limited, including but not limited to bank records, canceled checks, 
money drafts, letters of credit, cashier’s checks, safe deposit records, checkbooks, 
and check stubs, duplicates and copies of checks, deposit items, savings passbooks, 
wire transfer records, and similar bank and financial account records; 

f. Physical items purchased through the use of funds from Cy priot accounts, including 
but not limited to rugs purchased from J^|[|^JJHlaBijanBlac^Utanium 
“Royal Way” watch, and clothing purchased from 



1 
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g. Evidence relevant to any false statements, pretenses, representations, or material 
omissions in connection with communications with the Department of Justice, the 
Internal Revenue Service, tax preparers, accountants, or banks; 

h. Communications, records, documents, and other files involving any of the 
attendees of the June 9, 2016 meeting at Trump tower, as well as Aras and Amin 
Agalorov; 

i. Evidence indicating Manafort’s state of mind as it relates to the crimes under 
investigation; 

j. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with Manafort about any matters relating to 
activities conducted by Manafort on behalf of, for the benefit of, or at the direction 
of any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

k. Any and all daily planners, logs, calendars, or schedule books relating to Manafort 
or Gates. 

2. Computers or storage media used as a means to commit the Subject Offenses. 

3. For any computer or storage medium whose seizure is otherwise authorized by 
this warrant, and any computer or storage medium that contains or in which is stored records or 
information that is otherwise called for by this warrant (hereinafter, “COMPUTER”): 

a. evidence of who used, owned, or controlled the COMPUTER at the time the 
things described in this warrant were created, edited, or deleted, such as logs, 
registry entries, configuration files, saved usernames and passwords, 
documents, browsing history, user profiles, email, email contacts, “chat,” 
instant messaging logs, photographs, and correspondence; 

b. evidence of software that would allow others to control the COMPUTER, 
such as viruses, Trojan horses, and other forms of malicious software, as well 
as evidence of the presence or absence of security software designed to detect 
malicious software; 

c. evidence of the lack of such malicious software; 

d. evidence indicating how and when the computer was accessed or used to 
determine the chronological context of computer access, use, and events 
relating to crime under investigation and to the computer user; 

e. evidence indicating the computer user’s state of mind as it relates to the crime 
under investigation; 

f. evidence of the attachment to the COMPUTER of other storage devices or 
similar containers for electronic evidence; 


2 
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g. evidence of counter-forensic programs (and associated data) that are designed 
to eliminate data from the COMPUTER; 

h. evidence of the times the COMPUTER was used; 

i. passwords, encryption keys, and other access devices that may be necessary to 
access the COMPUTER; 

j. documentation and manuals that may be necessary to access the COMPUTER 
or to conduct a forensic examination of the COMPUTER; 

k. records of or information about Internet Protocol addresses used by the 
COMPUTER; 

l. records of or information about the COMPUTER’S Internet activity, including 
firewall logs, caches, browser history and cookies, “bookmarked” or 
“favorite” web pages, search terms that the user entered into any Internet 
search engine, and records of user-typed web addresses; 

m. contextual information necessary to understand the evidence described in this 
attachment. 

As used above, the terms “records” and “information” includes all forms of creation or 
storage, including any form of computer or electronic storage (such as hard disks or other media 
that can store data); any handmade form (such as writing); any mechanical form (such as printing 
or typing); and any photographic form (such as microfilm, microfiche, prints, slides, negatives, 
videotapes, motion pictures, or photocopies). 

The term “computer” includes all types of electronic, magnetic, optical, electrochemical, 
or other high speed data processing devices performing logical, arithmetic, or storage functions, 
including desktop computers, notebook computers, mobile phones, tablets, server computers, and 
network hardware. 

The term “storage medium” includes any physical object upon which computer data can 
be recorded. Examples include hard disks, RAM, floppy disks, flash memory, CD-ROMs, and 
other magnetic or optical media. 


3 
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Electronic Evidence & Search Warrant Transmittal Form 


Case No. l:17-SW-449 _ 

I. Type of Legal Request: 


Date: July 25. 2017 

(S)AUSA: ■■■ 


□ ECPA Grand Jury Subpoena and Non-Disclosure □ PRTT/Search Warrant Hybrid 

Order (§§ 2703(c)(2), 2705(b)) (§§ 3122(a)(1), 2703(c)(1)(A)) 

□ ECPA Court Order (§ 2703(d)) / Regular Search Warrant (Rule 41(e)(2)(A)) 

□ ECPA Content Search (§ 2703(a), (b)(1)(A)) □ ESI Search Warrant (Rule 41(e)(2)(B)) 

□ Pen Register/Trap & Trace (§ 3122(a)(1)) □ Tracking Device Search Warrant (Rule 41 (e)(2)(C)) 

□ Other _ 

II. Information To Be Obtained or Items To Be Searched/Seized : 


. □ Cell Phone Account from Provider 

□ Land Line Account from Provider 

□ Email Account from Provider 

□ IP Address from Provider 

□ Real-Time Cell Site Records from Provider 

III. Investigative Offense: 

□ Drugs 

□ Extortion/Racketeering 

□ Fraud 

□ Fugitive/Escape 
’ □ Immigration 

□ Kidnapping 

IV, Delayed Notice: 

: □ ECPA Non-Disclosure (§§ 2703(d), 2705(b)) 

□ Initial - 2 years □ Renewal 

□ ECPANomDisclosure for Priority Terrorism 
Enterprise Investigations (§§ 2703(d), 2705(b)) 

□ Initial - 3 years □ Renewal 

□ PRTT Non-Disclosure (§§ 3123(d)(2)) 

□ Initial - 5 years □ Renewal 


□ Social Media/Messaging Account from Provider 

□ Computer/Laptop/Hard Drive/Cell Phone 
(Rule 41(e)(2)(A)) 

□ Tracking Device (Rule 41(e)(2)(C)) 

I / Premises/Property/Vehicle (Rule 41(e)(2)(A)) 

□ Other_ 

□ Sex Offenses 

□ Tax 

□ Terrorism 
I □ Theft 

! □ Weapons 

/ Other 31 U.S.C. §§ 5314 & 5322(a); 22 U.S.C. 

§ 611 etseq. (FARA); 18 U.S.C. §§ 2, 371,1341, 
1343, 1349, 1956, & 1957; and 52 U.S.C. §§ 
30121(a)(1)(A) & (a)(2) 

Kl Search Warrant Delayed Notice 
(§ 3103a(b), Rule 41(f)(3)) 

□ Rule 41(e)(2)(A), (B), or (C) Warrants 

□ § 2703(a), (b)(1)(A), or (c)(1)(A) Searches 

3^ Days 
_Days Extension 


Updated: 5/2/17 
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AO 106 (Rev. 04/10) Application for a Search Warrant 

United States District Court 

for the 

Eastern District of Virginia 

In the Matter of the Search of \ 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ^ Case No. Ill 7SW449 

THE PREM ISES LOCATED ■ ) 

ALEXANDRIA, VIRGINIA 22314 ) 

APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to bel ieve that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A 

located in the _ Eastern _District of_ Virginia _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B 


■ JOL 25 20l/ 

Under Seal- 

* * .. t • » * 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
i?f evidence of a crime; 

sf contraband, fruits of crime, or other items illegally possessed; 

property designed for use, intended for use, or used in committing a crime; 
□ a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 

Code Section 
See attached Affidavit. 


Offense Description 


The application is based on these facts: 
See attached Affidavit. 


Continued on the attached sheet. 

□ Delayed notice of__ days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103 a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: 


[|JJ| Special Agent, FBI 
Printed name and title 




Sworn to before me and signed in my presence. 
Date: 07/25/2017 



_/s/_ 

Theresa Carroll Buchanan 
UnijuciStaLes Magistrate Judge 

Judge's signature 


City and state: Alexandria, VA 


The Honorable Theresa C. Buchanan 


Printed name and title 
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ATTACHMENT A 
The Property to Be Searched 

The premises to be searched (the’“Subject Premises”) is the condominium unit located at 

Alexandria, VA 22314, including the storage unit numbered | 
| as well as any locked drawers, containers, cabinets, safes, computers, electronic devices, and 
storage media (such as hard disks or other media that can store data) found therein. 
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ATTACHMENT B 


Items to Be Seized (or, in the alternative, identified) 

1. Records relating to violations of 31 U.S.C. §§5314, 5322(a) (failure to file a report 
of foreign bank and financial accounts); 22 U.S.C. § 611, et. seq . (foreign agents registration act); 
26 U.S.C. § 7206(1) (filing a false tax return); 18 U.S.C. § 1014 (fraud in connection with the 
extension of credit); 18 U.S.C. §§ 1341,1343, and 1349 (mail fraud, wire fraud, and conspiracy to 
commit these offenses); 18 U.S.C. §§ 1956 and 1957 (money laundering and money laundering 
conspiracy); 52 U.S.C. §§ 30121(a)(1)(A) and (a)(2) (foreign national contributions); and 18 
U.S.C. §§ 371 and 2 (conspiracy, aiding and abetting, and attempt to commit such offenses) 
(collectively, the “Subject Offenses”), occurring on or after January 1, 2006, including but not 
limited to: 

a. Any and all financial records for Paul Manafort, Jr., B|H||^^^HHRichard 

Gates, or companies associated with Paul Manafort7Jr71||||^^^^^BiiH or 
Richard Gates, including but not limited to records relating to any foreign financial 
accounts and records relating to payments by or on behalf of any foreign 

government, foreign officials, foreign entities, foreign persons, or foreign 

principals; 

b. Any and all federal and state tax documentation, including but not limited to 
personal and business tax returns and all associated schedules for Paul Manafort, 
Jr., Richard Gates, or companies associated with Manafort or Gates; 

c. Letters, correspondence, emails, or other forms of communications with any 
foreign financial institution, or any individual acting as the signatory or controlling 
any foreign bank account; 

d. Records relating to efforts by Manafort, Gates, or their affiliated entities to conduct 

activities on behalf of, for the benefit of, or at the direction of any foreign 

government, foreign officials, foreign entities, foreign persons, or foreign 

principals, including but not limited to the Party of Regions and Viktor 
Yanukovych; 

e. Records relating to, discussing, or documenting Telmar Investments Limited, 
Tiakora Ventures Limited, Lucicle Consultants Limited, Actinet Trading Limited, 
Black Sea View Limited, Bletilla Ventures Limited, Evo Holdings Limited, Global 
Highway Limted, Leviathan Advisors Limited, Loav Advisors Limited, Peranova 
Holdings Limited, including but not limited to bank records, canceled checks, 
money drafts, letters of credit, cashier’s checks, safe deposit records, checkbooks, 
and check stubs, duplicates and copies of checks, deposit items, savings passbooks, 
wire transfer records, and similar bank and financial account records; 

f. Physical items purchased through the use of funds from Cyp riot accounts, including 

but not limited to rugs purchased from a Bijan Black Titanium 

“Royal Way” watch, and clothing purchased from BHHHBHBBB 
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g. Evidence relevant to any false statements, pretenses, representations, or material 
omissions in connection with communications with the Department of Justice, the 
Internal Revenue Service, tax preparers, accountants, or banks; 

h. Communications, records, documents, and other files involving any of the 
attendees of the June 9, 2016 meeting at Trump tower, as well as Aras and Amin 
Agalorov; 

i. Evidence indicating Manafort’s state of mind as it relates to the crimes under 
investigation; 

j. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with Manafort about any matters relating to 
activities conducted by Manafort on behalf of, for the benefit of, or at the direction 
of any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

k. Any and all daily planners, logs, calendars, or schedule books relating to Manafort 
or Gates. 

2. Computers or storage media used as a means to commit the Subject Offenses. 

3. For any computer or storage medium whose seizure is otherwise authorized by 
this warrant, and any computer or storage medium that contains or in which is stored records or 
information that is otherwise called for by this warrant (hereinafter, “COMPUTER”): 

a. evidence of who used, owned, or controlled the COMPUTER at the time the 
things described in this warrant were created, edited, or deleted, such as logs, 
registry entries, configuration files, saved usernames and passwords, 
documents, browsing history, user profiles, email, email contacts, “chat,” 
instant messaging logs, photographs, and correspondence; 

b. evidence of software that would allow others to control the COMPUTER, 
such as viruses, Trojan horses, and other forms of malicious software, as well 
as evidence of the presence or absence of security software designed to detect 
malicious software; 

c. evidence of the lack of such malicious software; 

d. evidence indicating how and when the computer was accessed or used to 
determine the chronological context of computer access, use, and events 
relating to crime under investigation and to the computer user; 

e. evidence indicating the computer user’s state of mind as it relates to the crime 
under investigation; 

f. evidence of the attachment to the COMPUTER of other storage devices or 
similar containers for electronic evidence; 
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g. evidence of counter-forensic programs (and associated data) that are designed 
to eliminate data from the COMPUTER; 

h. evidence of the times the COMPUTER was used; 

i. passwords, encryption keys, and other access devices that may be necessary to 
access the COMPUTER; 

j. documentation and manuals that may be necessary to access the COMPUTER 
or to conduct a forensic examination of the COMPUTER; 

k. records of or information about Internet Protocol addresses used by the 
COMPUTER; 

l. records of or information about the COMPUTER’S Internet activity, including 
firewall logs, caches, browser history and cookies, “bookmarked” or 
“favorite” web pages, search terms that the user entered into any Internet 
search engine, and records of user-typed web addresses; 

m. contextual information necessary to understand the evidence described in this 
attachment. 

As used above, the terms “records” and “information” includes all forms of creation or 
storage, including any form of computer or electronic storage (such as hard disks or other media 
that can store data); any handmade form (such as writing); any mechanical form (such as printing 
or typing); and any photographic form (such as microfilm, microfiche, prints, slides, negatives, 
videotapes, motion pictures, or photocopies). 

The term “computer” includes all types of electronic, magnetic, optical, electrochemical, 
or other high speed data processing devices performing logical, arithmetic, or storage functions, 
including desktop computers, notebook computers, mobile phones, tablets, server computers, and 
network hardware. 

The term “storage medium” includes any physical object upon which computer data can 
be recorded.. Examples include hard disks, RAM, floppy disks, flash memory, CD-ROMs, and 
other magnetic or optical media. 
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UNITED STATES DISTRICT COURT fJUL 2 5 PtH 

EASTERN DISTRICT OF VIRGINIA 


Alexandria Division 


i 

i 

i 

THE PREMISES LOCATED AT 

ALEXANDRIA, i 
VIRGINIA 22314 j 




Criminal No. l:17-sw-449 

Filed Under Seal 


AFFIDAVIT IN SUPPORT OF AN 
APPLICATION FOR A SEARCH WARRANT 



Federal Bureau of Investigation (“FBI”), being duly sworn, deposes and 


says: 

I. Introduction 
A. Affiant 

1. I am a Special Agent with the FBI and have been since 2015. I am currently 
assigned to the investigation being conducted by the Department of Justice Special Counsel. As a 
Special Agent of the FBI, I have received training and experience in investigating criminal and 
national security matters. Prior to my employment with the FBI, I spent seven years in the software 
industry and have extensive experience working with computer technology. 

2. I make this affidavit in support of an application pursuant to Rule 41 of the Federal 
Rules of Criminal Procedure for a warrant to search the premises located at HHHHHHBI 
■M Alexandria, Virginia 22314 (the “Subject Premises”), which is described more 
particularly in Attachment A, in order to locate and seize (and/or photograph) the items described 
in Attachment B. This affidavit is based upon my personal knowledge, my review of documents 
and other evidence, my conversations with other law enforcement personnel, and my training and 
experience. Because this affidavit is being submitted for the limited purpose of establishing 
probable cause, it does not include all the facts that I have learned during the course of my 
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investigation. Where the contents of documents and the statements, and conversations of others 
are reported herein, they are reported in substance and in pertinent part, except where otherwise 
indicated. 

B. The Subject Offenses 

3. For the reasons detailed below, there is probable cause to believe that the Subject 
Premises contain evidence, fruits, and instrumentalities of violations of: 31 U.S.C. §§ 5314, 
5322(a) (failure to file a report of foreign bank and financial accounts); 22 U.S.C. § 611, et. seq. 
(foreign agents registration act); 26 U.S.C. § 7206(1) (filing a false tax return); 18 U.S.C. § 1014 
(fraud in connection with the extension of credit); 18 U.S.C. §§ 1341, 1343, and 1349 (mail fraud, 
wire fraud, and conspiracy to commit these offenses); 18 U.S.C. §§ 1956 and 1957 (money 
laundering and money laundering conspiracy); 52 U.S.C. §§ 30121(a)(1)(A) and (a)(2) (foreign 
contribution ban); and 18 U.S.C. §§371 and 2 (conspiracy, aiding and abetting, and attempt to 
commit such offenses) (collectively, the “Subject Offenses”). 

II. Probable Cause 

4. As set forth herein, there is probable cause to believe that the Subject Offenses have 
been committed by Paul J. Manafort, Jr., the former campaign chairman of Donald Trump for 
President, Inc., and others known and unknown. Between at least 2006 and 2014, Manafort, a 
United States citizen, worked as a lobbyist and political consultant for the Party of Regions, a 
Ukrainian political party commonly believed to be aligned with Russia. There is probable cause 


to believe that Manafort engaged in a scheme to hide income paid on behalf of Ukrainian 
politicians and others through foreign bank accounts in Cyprus and elsewhere, to and on behalf of 
Manafort and related people and companies. 

5. There is also probable cause to believe that Manafort participated in a scheme to 

financial 
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6. By way of background concerning Manafort, based on publicly available 
information, in March of 2016, Manafort officially joined Donald J. Trump for President, Inc. (the 
‘Trump Campaign”), the presidential campaign of then candidate Trump, in order to, among other 
things, help manage the delegate process for the Republican National Convention. In May of 
2016, Manafort became chairman of the Trump Campaign. In June of 2016, Manafort reportedly 
became de facto manager for the Trump Campaign with the departure of prior campaign manager 
Corey Lewandowski. On August 19, 2016, after public reports regarding connections between 
Manafort, Ukraine, and Russia - including an alleged “black ledger” of off-the-book payments 
from the Party of Regions to Manafort - Manafort left his post as chairman of the Trump 
Campaign. 

7. Portions of the information set forth below (as well as certain additional facts not 
relevant herein) were set forth in (1) an affidavit by Special Agent 

submitted in support of a warrant to search a storage locker in Alexandria, Virginia 
used by Manafort (“Storage Locker Search Warrant”); (2) an affidavit by Special Agent |m 

submitted in support of a search warrant for the email account used 
by Manafort (“Email Search Warrant”); and (3) an affidavit by Special Agent 
WKKKKtKKKKk submitted in support of a warrant to search a hard drive associated with 
Manafort’s business entities (“Hard Drive Search Warrant”). On May 27, 2017, the Honorable 
Theresa Carroll Buchanan, United States Magistrate Judge for the Eastern District of Virginia, 
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issued the Storage Locker Search Warrant upon a finding of probable cause; on June 21,2017, the 
Honorable James L. Cott, United States Magistrate Judge for the Southern District of New York, 
issued the Email Search Warrant upon a finding of probable cause; and on June 14, 2017, Chief 
Judge Beryl Howell of the District of the District of Columbia issued the Hard Drive Search 
Warrant upon a finding of probable cause. Copies of the search warrant affidavits are attached 
hereto as Attachments C-E, respectively. 

A. Manafort’s Work for Ukraine 

8. The information contained herein is based on public records; bank records and 
reports; Davis Manafort records; tax filings by Manafort and Richard W. Gates, IU, a Davis 
Manafort employee; the June 2017 filing by DMP International, LLC, Manafort, and Gates under 
the Foreign Agents Registration Act (FARA); and statements by Manafort and Gates to the FBI, 
among other things. 

9. Manafort and Gates have been employed for many years through Davis Manafort 
and related entities as lobbyists and political consultants working both in the United States and 
internationally. Beginning in or about 2006 and at least until 2014, Manafort provided political 
and policy services to the Ukrainian Party of Regions, including Viktor Yanukovych, head of the 
Party of Regions and the President of Ukraine from 2010 to 2014. Gates told the FBI in an 
interview in July 2014 (“the Gates Interview”) that he was hired by Manafort in 2006 and worked 
on Ukrainia n election and policy advice, up to the time of the interview. Gates advised that in 
2010, he and Manafort were in Ukraine for over two months leading up to the election that brought 
Yanukovych to power. Manafort told the FBI in ah interview also in July 2014 (“the Manafort 
Interview”) that he performed work for the Party of Regions, as well as significant work for Rinat 
Akhmetov, a financial supporter of President Yanukovych, and for Oleg Deripaska, a Russian 
oligarch. 
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10. Based on reporting from multiple sources, the FBI believes that Yanukovych’s 
government engaged in systematic public corruption. The same sources report that corrupt 
government officials and their allies in the business community during Yanukovych’s presidency 
looted Ukraine’s public coffers of millions of dollars and funneled those assets to foreign bank 
accounts to hide the embezzlement. The current government of Ukraine has sought the assistance 
of the United States and Cyprus to locate and recover these misappropriated assets. Yanukovych, 
who fled to Russia in 2014, is currently wanted in Ukraine for numerous criminal violations, 
including the embezzlement and misappropriation of public property. In late June 2017, media 
outlets such as Bloomberg reported that Ukrainian prosecutors had uncovered no evidence of illicit 
payments to Manafort as part of their investigation into suspected criminal conduct by former 
Ukrainian officials. In a statement available on its public website dated June 29, 2017, Ukraine’s 
National Anti-Corruption Bureau of Ukraine (NABU) provided the following context by 
announcing that it “did not conduct an official investigation regarding Paul Manafort. He has 
never been a Ukrainian official, and therefore cannot commit corruption acts, according to the 
Ukrainian laws. An assessment of the actions of the abovementioned person should be made by 
the competent authorities of other countries, whose jurisdiction extends to the investigation of the 
facts of probable offenses.” 

1. Payments from Cypriot Accounts to and for Manafort 

11. From in or about at least 2008 to at least 2014, payments from bank accounts in 
Cyprus - nominally owned by foreign companies - were used to make payments to (a) United 
States corporate and personal bank accounts controlled by Manafort or Gates and (b) United States 
vendors for services provided to Manafort or Gates. During this time period, tens of millions of 
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dollars from these foreign accounts were paid “directly” 1 and indirectly to Manafort, Gates, and 
Manafort-related entities, 

12. Based on the evidence set forth more fully below, there is probable cause to believe 
that Manafort and Gates maintained Cypriot bank accounts held in the names of numerous entities, 


which include those listed in the chart below: 


Company 

Bank Name 

Account # 

Transaction Example 




On or about June 27, 

Telmar 

Bank of 


2014, $250,000 was sent 

Investments 

Cyprus PCL 


to an account in the name 

Limited 

Ltd 


of DMP International, 
LLC at HSBC Bank. 




On or about September 2, 
2010, $1 million was sent 
to an account in the name 
of Global Sites LLC at 

Yiakora 

Bank of 


Wachovia Bank. 

Ventures 

Cyprus PCL 


On or about June 4, 2008, 

Limited 

Ltd 


$8 million was sent to an 
account in the name of 
Jesand Investment 

Corporation at First 
Republic Bank. 


Cyprus 


On or about November 9, 

Lucicle 

Popular Bank 

(Previously 

Marfin 

Popular 

Bank) 


2012, $300,000 was sent 
to an account in the name 
of DMP International, 
LLC at JPMorganChase 
Bank. 

Consultants 


Limited 


Actinet 

Cyprus 

Popular Bank 

(Previously 

Marfin 

Popular 

Bank) 


On or about August 1, 
2012, $70,000 was sent to 

Trading 


an account in the name of 

Limited 


DMP International, LLC 
at JPMorganChase Bank. 


1 The term “directly” is used to differentiate the “indirect” Manafort payments made to vendors 
that provided services to Manafort. Wires from Cypriot accounts that were sent to Davis Manafort 
would also at various times be passed through more than one United States account affiliated with 
Manafort before being used to pay for Davis Manafort expenses as well as other items. 
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Company 


Black Sea 
View Limited 


Bletilla 

Ventures 

Limited 


Evo Holdings 
Limited 



Limited 


Leviathan 

Advisors 

Limited 


Loav 

Advisors 

Limited 


Lucicle 

Consultants 

Limited 


Bank Name 


Cyprus 

Popular Bank 

(Previously 

Marfin 

Popular 

Bank) 


Cyprus 

Popular Bank 
(Previously 
Marfin 
Popular 
Bank 


Cyprus 

Popular Bank 

(Previously 

Marfin 

Popular 

Bank) 


Cyprus 

Popular Bank 

(Previously 

Marfin 

Popular 

Bank) 


Cyprus 

Popular Bank 
(Previously 
Marfin 
Popular 
Bank 


Cyprus 

Popular Bank 

(Previously 

Marfin 

Popular 

Bank) 


Cyprus 

Popular Bank 

(Previously 

Marfin 

Popular 

Bank) 


Account # 



Transaction Example 


On or about December 
21, 2011, $1 million was 
sent to an account in the 
na me of Paul J Manafort 

and mmmHH 

at First Republic Bank. 


On or about April 10, 
2012, $900,000 was sent 
to an account in the name 
of DMP International, 
LLC at JPMorganChase 
Bank. 


On or about January 30, 
2009, $70,000 was sent to 
an account in the name of 
Davis Manafort Partners, 
Inc. at Wachovia Bank. 


On or about December 
23, 2009, $500,000 was 
sent to an account in the 
name of Davis Manafort 
Partners, Inc; at 
Wachovia Bank. 


On or about May 27, 
2011, $258,000 was sent 
to an account in the name 
of Davis Manafort 
Partners, Inc. at First 
Republic Bank. 


On or about October 7, 
2010, $120,000 was sent 
to an account in the name 
of Paul J Manafort and 


Wachovia Bank. 


On or about June 27, 
2012, $650,000 was sent 
to an account in the name 
of DMP International, 
LLC at JPMorganChase 
Bank. 
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Company 

Bank Name 

Account # 

Transaction Example 

Peranova 

Cyprus 

Popular Bank 

(Previously 

Marfin 

Popular 

Bank) 


On or about February 1, 
2012, $1.5 million was 
sent to an account in the 
name of DMP 

International, LLC at 
First Republic Bank. . 

Holdings 


Limited 


Telmar 

Eurobank 
Cyprus Ltd 


On or about January 16, 
2014, $500,000 was sent 

Investments 


to an account in the name 

Limited 


of DMP International, 
LLC at HSBC Bank. 

Actinet 

Trading 

Limited 



On or about April 8,2013, 
$200,000 was sent to an 
account in the name of 
DMP International, LLC 
at HSBC Bank. 

Hellenic Bank 
PCL Ltd 




Bletilla 

Hellenic Bank 
PCL Ltd 


On or about March 1, 
2013, $300,000 was sent 

Ventures 


to an account in the name 

Limited 


of Symthson LLC at 
JPMorganChase Bank. 

Lucicle 

Hellenic Bank 
PCL Ltd 


On or about February 15, 
2013, $500,000 was sent 

Consultants 


to an account in the name 

Limited 


of Symthson LLC at 
JPMorganChase Bank. 


13. The FBI has obtained bank records that evidence that Manafort controlled and/or 
held executive positions at the following United States entities, which received tens of millions of 

» 

dollars from the above-listed financial accounts in Cyprus between at least 2008 to at least 2014: 

(1) Davis Manafort Partners, Inc.; 

(2) DMP International, LLC; 

(3) Global Sites LLC; and 

(4) Jesand Investment Corporation 2 . 


2 Jesand Investment Corporation was incorporated in Virginia in 2002 and dissolved in 2013. It 
lists its addresses a s Manafort’s address es in Alexandria, Virginia and Palm Beach Gardens, 
Florida. the name “Jesand” is 
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Bank records also reflect that Gates held signature authority over the account in the name of 
Symthson LLC 3 . 

14. In addition, bank records evidence that millions of dollars were wired directly from 

the Cypriot accounts to pay vendors for goods and services provided to and for Manafort. For 
instance, funds from these foreign accounts were used to rent a villa in Italy at which the Manaforts 
vacationed (over $49,000); to pay for rugs from an Alexandria store called mHHHHHIi 
(over $360,000); to pay for landscaping services for the Manaforts (over $395,000); and to pay 
two separate clothiers clothing purchased by Manafort 

(over $400,000 and $360,000 respectively). The records for one of the clothiers 

- evidence that Manafort was aware of and controlled these foreign wire payments, as he noted to 
the vendor in two spring 2011 emails that the vendor would be paid shortly from the Leviathan 
Holdings Cypriot account, noted above. 

15. Manafort and Gates have both told the FBI in interviews in 2014 that they were 
paid for their work for the Ukrainian Party of Regions through Cypriot bank accounts. In the 
Manafort Interview, Manafort claimed he did not know who specifically set up the Cypriot 
accounts, but they were vehicles used to pay him for public political services. Manafort 
specifically acknowledged that any money flowing from the accounts held in the name of Global 
Highway Ltd. and Leviathan (two entities listed above) would have been money he earned from 
his services. In the Gates Interview, Gates admitted he was directed to open accounts in Cyprus 
by President Yanukovych’s Chief of Staff Boris Kolesnikov. He was told it was easier for them 
to be paid from one Cyprus account to another Cyprus account. Gates said that various oligarchs 

3 Smythson LLC was incorporated in Delaware in 2008. Note that bank accounts for this company 
were opened under the name “Symthson,” using addresses listed for Manafort in other of his 
companies. 
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would chip in to pay them for their consulting work. Gates identified Lucicle, Bletilla, Leviathan, 
and Global Endeavor (among others) as accounts opened to receive such payments. 

16. In addition, in 2014 Manafort wrote to the First Republic Bank, a United States 
financial institution, to object to the bank’s determination to close all the Manafort-related 
accounts based on its anti-money laundering policies and concerns about incoming international 
wires. In his correspondence to the bank, Manafort admitted he was paid by Ukraine but he 
claimed that the money he received from Ukraine was for “very public consulting services” from 
“legitimate activities that were totally legal.” Manafort also wrote the bank that he had “[n]o 
interaction with oligarchs for business.” However, in the Manafort Interview conducted that same 
year, Manafort told the FBI that he did significant work for Deripaska, a Russian oligarch. And 
in March 2017 r in response to press reports concerning a written annual contract between Manafort 
and Deripaska, Manafort publicly confirmed that he had provided investment consulting services 
to Deripaska interests. a ^ so told the FBI that 

Deripaska helped fund Manafort’s Ukrainian work when it began in 2005-06. 4 And the 2010 tax 
returns for a company jointly owned by Manafort and his wife - John Hannah, LLC 5 - reveals a 
$10,000,000 loan to the company from a “Russian lender.” A court-authorized search in May 
2017 of a storage locker in Virginia used by Manafort revealed documents that show that the 



5 John Hannah, LL C was located at the same address as Davis Manafort, Inc. 

WKKBEBHi Alexandria, Virginia, 223 14, and re ceived mail there. The company also 
received mail at the Manafort home in Florida. th e name °f the company is derived from 

the respective middle names of Manafort and Gates, Manafort declared on his tax returns, 
discussed below, income from John Hannah, LLC. 
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identity of the Russian lender was “Derapaska.” Finally, in the Gates Interview, Gates admitted 
that Manafort met with another oligarch, to discuss a New York real estate 

transaction they would undertake together and to pitch other ideas. In the Manafort Interview, 
Manafort also admitted approaching to propose the New York deal, which according to 

business records publicly filed in a New York litigation was initiated in 2008. 

2. Manafort and Gates Tax Returns 

17. There is probable cause to believe that Manafort failed to properly disclose to the 
United States government his relationship to the Ukrainian Party of Regions, the income he 
received (directly or indirectly) as a result of his work for that party, and the existence of foreign 
accounts in which he held a financial interest (and into which payments from Ukrainian politicians 
were deposited, as discussed above). 

18. Pursuant to a tax order from the Eastern District of Virginia (Buchanan, J.) dated 
April 14, 2017, the FBI has obtained and reviewed, among others, the tax returns for Manafort 
and Gates for 2009-2014. In all of the tax returns, Manafort and Gates submitted a Schedule B 
form, which required them to declare whether they have “an interest in or a signature or other 
authority over a financial account in a foreign country, such as a bank account, securities 
account, or other financial account.” Each year, Manafort and Gates declared “No.” That same 
form also contained a cross-reference to the requirement to file a Report of Foreign Bank and 
Financial Accounts (FBAR) to report overseas financial interests or signature authority. An 
FB AR filing is required, on a yearly basis, if a United States person has a financial interest in or 
signatory authority over at least one financial account located outside the United States and at 
least $10,000 in aggregate value in foreign accounts at any time during the calendar year. As 
discussed above, there is probable cause to believe that Manafort and Gates had a financial 
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interest, in excess of $10,000, in various accounts in Cyprus in at least 2008-14. A review of 
data from the Financial Crimes Enforcement Network (commonly known as FinCEN) shows 
that Manafort and Gates have not filed an FBAR for at least the years 2008 to the present. 

19. A search of the United States Department of Justice database of all agents currently 
or previously registered under FARA, conducted in July 2017, also discloses that Manafort, Gates, 
and their affiliated entities, including Davis Manafort, failed to register as agents of a foreign 
government until June 27, 2017. 6 As long-time lobbyists, Manafort and Gates would know about 
the FARA requirements. Indeed, in email communications between Gates 

(a United States lobbying and public affairs firm) concerning joint Ukraine work, Gates 
demonstrated that he was clearly aware in 2012 of FARA filing rules. 

20. In addition, the foreign source income listed in the tax returns for Manafort does 
not appear to account for the above distributions to or from the Cypriot accounts on his behalf. 
For instance, the 2009 Manafort tax return indicates $17,736 in gross foreign source income; in 
2010, $42,789; in 2011, $165,871; in 2012, $129,777; in 2013, $38,375; and in 2014, $39,468. 

21. The bank records, however, reveal the following: 

• In 2008, the Cypriot accounts transferred at least $3,500,000 to accounts in the joint 

names of Paul and Manafort and transferred at least $9,000,000 to 

accounts of United States entities affiliated with Manafort. 

• In 2009, the Cypriot accounts transferred at least $ 1,500,000 to accounts in the joint 

names of Paul and Manafort, transferred at least $35,000 to accounts in 

the names of Manafort’s relatives, transferred at least $3,000,000 to accounts of 


6 The database is publicly available at https://www.fara. gov/ . 
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United States entities affiliated with Manafort, and transferred at least $200,000 to 
accounts of third parties as payment for the benefit of Manafort. 

• In 2010, the Cypriot accounts transferred at least $2,000,000 to accounts in the joint 

names of Paul and Manafort, transferred at least $80,000 to accounts in 

the names of Manafort’s relatives, transferred at least $6,000,000 to United States 
entities affiliated with Manafort, and transferred at least $600,000 to accounts of 
third parties as payment for the benefit of Manafort. 

• In 2011, the Cypriot accounts transferred at least $1,800,000 to an account in the 
joint names of Paul and m Manafort, transferred at least $30,000 to an 
account in the name of a Manafort relative, transferred at least $3,000,000 to an 
account of a United States entity affiliated with Manafort, and transferred at least 
$500,000 to accounts of third parties as payment for the benefit of Manafort. 

• In 2012, the Cypriot accounts transferred at least $200,000 to an account in the joint 

names of Paul and Manafort, transferred at least $8,500,000 to accounts 

of United States entities affiliated with Manafort, and transferred at least 
$1,000,000 to accounts of third parties as payment for the benefit of Manafort. 

• In 2013, the Cypriot accounts transferred at least $2,500,000 to accounts of United 
States entities affiliated with Manafort and transferred at least $1,000,000 to 
accounts of third parties as payment for the benefit of Manafort. 

• In 2014, the Cypriot accounts transferred at least $5,000,000 to accounts of United 
States entities affiliated with Manafort. 

22. There appears to be no legitimate business reason for these transactions, which 
appear to pass funds from a Ukrainian political party through more than one Cypriot bank 
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account; have payments made directly to United States vendors from the Cypriot accounts; and 
pass money brought onshore from Cyprus through multiple United States accounts. Based on 
my training and experience, these transactions evidence in my view the crimes of tax evasion 
and money laundering to conceal the origins of the funds paid to Manafort and Gates. 

B. Manafort’s Loan Applications 

23. There is also probable cause to believe that Manafort made misrepresentations and 
material omissions for the purpose of securing loans from BIHHI^^HBI^HII^^^^^B 
BBBBBBHHBiiH is a Federal Deposit Insurance Corporation member bank. 
The information contained herein is based on information set forth in the attached BHB 
Affidavit, which is based on public records, financial records and reports, court records, and 
information provided by other law enforcement personnel, among other things. 

24. Based on court filings and records obtained from Genesis Capital Corporation 

(“Genesis”), in February 2016, Genesis, through an affiliated entity, extended two loans to MC 
Brooklyn Holdings LLC (“MC Brooklyn Holdings”) totaling approximately $5.3 million. MC 
Brooklyn Holdings is the holding company for a townhouse located Brooklyn, 

New York 11231 (“Brooklyn Property”). MC Brooklyn Holdings’ members are Manafort, B 

BBS Manafort also personally guaranteed the $5.3 million loans from Genesis. 

25. Additionally, based on documents obtained from|BH ^ February 2016, Genesis 
funded a refinance and construction loan for approximately $3.7 million, secured by a property 
located |^HBIII^^BHI^^BBM S Angeles, California (“Los Angeles Property”). The Los 
Angeles Property was held byB^^BI^^BI^Hi LLC, a company in which (as of February 
2016) Manafort andBH held e 9 ua l interest. 
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26. Both sets of Genesis loans went into default in 2016. As a consequence,- on 
September 20,2016, a Genesis affiliate filed an action in New York Supreme Court, Kings County 
(the ‘"Foreclosure Action”), seeking to foreclose the loans encumbering the Brooklyn Property. 
After its initiation, the Foreclosure Action was adjourned several times as Manafort and 
sought refinancing. 

27. As explained in the Affidavit attached hereto, based on documents obtained 

from^H beginning in 2016, Manafort began negotiations with^ for the extension of loans 
for several purposes, including to refinance the Genesis loans that were in default. These 
negotiations ultimately resulted in extending two sets of loans to Manafort-linked entities 
in the total amount of approximately $16 million. One loan, for approximately $9.5 million 
(enough to cover the outstanding balance on the Genesis loan secured by the Los Angeles Property) 
was extended to a company called Summerbreeze LLC that was owned by 

(hereinafter, the ‘|HI Summerbreeze Loan”). A second set of |[^| loans, in the amount of 
$6.5 million, was secured by the Brooklyn Property and was used to refinance the Genesis loans 
secured by that property (hereinafter, “the Brooklyn Property Loan”). That refinancing 
ultimately terminated the Genesis Foreclosure Action. 

28. As described below, Manafort made several materially inconsistent representations 
during the process of negotiating for the m loans* including by making substantially different 
representations about his income and net worth on different loan applications (signed and 
unsigned) within a three-month period. And 
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1. Extension of Refinancing Loan 

29. According to documents obtained £rom^|[| on or about July 27, 2016, Manafort 
with 


to discuss a proposed loan from^^| to refinance the Genesis loan secured by the Los Angeles 
Property (“the Genesis Los Angeles Loan”), m and other members of the m loan committee 
approved the terms of this loan the next day. 
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33. On or about September 8,2016, Manafort’s attorney transmitted toUH a demand 

letter to sent by a debt collector, which demanded payoff for missed June 

and July payments on the Genesis Los Angeles Loan, including late fees and over $2,000 daily 
interest on the late fees, m forwarded this document to 

writing: “Just a fyi - looks like these guys are in default to Genesis.” m wrote back: 

“It is what it is. Let’s send it off to and have it be part of the file. mMHNMHHHMi 

2 . Extension of Additional Refinancing Loan Despite Manafort’s Initial 
$1 Million Understatement of Original Loan Amount 

34. Based on documents obtained from^^l in late August 2016, at approximately 

the time when Manafort officially left his position with the Trump Campaign, the company 
Summerbreeze LLC was formed, with as the sole member. 

m|| records show that Summerbreeze LLC then took out a loan from a subsidiary of the real 
estate investment company in the amount of approximately $3.5 million, 

secured by real estate in Water Mill, New York (hereinafter, the Loan”). 
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36. 



37. On September 27, 2016, copies of mortgage 

statements showing that the Loan was for approximately $3.5 million. 

re plied to all recipients: “What the hell he just took the loan out at the end 
of August how can he be $1,000,000 off!” replied, 

Is so 

mFBI agents interviewed 
who stated in substance, among other things, as follows: 

a. She discussed the loan with cou rse of 

her work on the loan, and m expressed to her on several occasions that the 
proposed Manafort loan was a bad loan. 

b. There were several issues with the proposed Manafort loan. For example, when 
she ran Manafort’s credit report in August of 2016, she saw that his credit had 
dropped significantly compared to his last credit report in June, due to an 
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approximately $300,000 debt Manafort had incurred on his American Express card 
(which Manafort claimed was because he had allowed a friend to use it to buy New 
York Yankees season tickets). Additionally, a number of Manafort’s assets turned 
out to be , less valuable than expected. Two pieces of real estate considered as 
collateral were each appraised at over $1 million less than the expected value, and 
an investment account of Manafort’s, which had believed would have a 

balance of $10 million, had a lower effective value because Manafort had taken out 
a $5 million line of credit against it. also considered it unusual to approve 

a construction loan (as the proposed Manafort loan was planned to be) for 
borrowers who, like Manafort and IB^acked construction experience. She also 
considered it unusual that||^| was willing to fund the loan despite Manafort’s 
and m default to Genesis Capital. 
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40. In early October 2016, before Manafort and closed on the originally 

contemplated refinancing of the Genesis Los Angeles Loan, documents provided by show 
that Manafort sought a second loan fromm that would refinance the Genesis loans secured by 
the Brooklyn Property, which were the subject of Genesis’s Foreclosure Action filed in September 
2016. 

3. Manafort’s Conflicting Representations in His Loan Applications 

41. During the course of applying and negotiating for lending from|HI Manafort 
made a series of conflicting representations in his loan applications about his income and net worth. 
Documents produced by show that on August 11, 2016, Manafort digitally signed a loan 
application for the proposed Los Angeles Property refinancing that listed his income as $275,000 
per month and his personal net worth as $17,051,676.17. 
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42. Two loans applications for the Summerbreeze Loan were also produced by 

unsigned by Manafort but dated October 26, 2016. Both listed Manafort’s income as 

approximately $224,846 per month. One listed the net worth of Manafort and his wife, as co¬ 
borrowers, as $21,376,722.13, and the other listed their net worth as $6 million lower, or 
$15,376,722.13. 

43. Two days after the date of these applications, on or about October 28, 2016, 
Manafort and his wife signed a loan application for the TFSB Summerbreeze Loan listing 
Manafort’s income as $100,652 per month and their net worth as co-borrowers as $34,685,418.13. 

44. On or about three days after that application was submitted, or November 1, 2016, 
Manafort and his wife signed a loan application for the Brooklyn Property Loan, which 
listed Manafort’s income as $224,846 per month and their net worth as co-borrowers as 
$14,994,402.13. 

45. Following these representations, the K Summerbreeze Loan closed on 
November 16, 2016. Of the total loan amount of $9.5 million, $7 million was underwritten by 

The final m credit approval memorandum produced by 
did not mention the Los Angeles Property Loan default or the Foreclosure Action against 
Manafort, and it assigned the Summerbreeze Loan a risk factor of “4 (Average).” jjf^H 


46. On January 17, 2017, thej^^l Brooklyn Property Loan was funded, resulting in 
$6.5 million being paid for the benefit of Manafort and his wife. The Genesis Foreclosure Action 
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was terminated by stipulation executed the next day. The final credit approval memorandum 
produced bym did not mention the default on the Genesis loans or the Foreclosure Action and 
assigned thej^m Brooklyn Property Loan a risk factor of “4 (Average).” 
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D. The Subject Premises 


60. Law enforcement databases and mortgage records show that Manafort maintains 

several residences, including a residence at the Subject Premises. The Subject Premises is located 
in a complex called Appraisal and title insurance documentation 

obtained fromH^I indicate that the Subject Premises is a three-bedroom condominium unit with 
2779 square feet of living space and includes two parking spaces numbered m and mi and 
one storage unit numbered |^m A law enforcement database shows that the property was 
purchased by Paul and Manafort on or about January 15, 2015 for $2,700,000 in cash. 

61. In email communications in July 2016, bank officials at 

who were working to approve loan to Manafort-related entities (as described above) characterized 
the Subject Premises as Manafort’s “primary residence.” In subsequent paperwork, Hftl 
identified Manafort’s residence in Florida as his primary residence on the basis of Manafort’s use 
of that address for income tax purposes. 

62. In several voluntary meetings with the FBI, an individual who 

works for Manafort, confirmed that Manafort maintains a residence at the Subject Premises, 
mil informed the FBI that he previously worked for Davis Manafort and that in late 2011 he 
began working more directly for Manafort. He currently receives his salary from Steam Mountain, 
LLC, which is another business operated by Manafort. advised that he performs a variety 

of functions for Manafort and his companies, as directed by Manafort. 
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63. In spring of 2017, advised the FBI that in approximately 2015, at the 

direction of Manafort, moved boxes of office files for Manafort’s businesses from one 

smaller storage unit at 370 Holland Lane, Alexandria, Virginia, to a larger storage unit (Unit 3013) 

i 

at the same storage facility. advised that he personally moved the office files into Unit 

3013. A search of Unit 3013 at 370 Holland Lane was conducted in late May of 2017 pursuant to 
a warrant issued by Magistrate Judge Theresa Carroll Buchanan. That search confirmed the 
information provided the FBI. Among the items that the FBI identified in that search were 

tax returns for Manafort and various Manafort-related business entities, documents related to 
Ukraine and the Party of Regions, and various financial documents. A copy of that search wanrant 
affidavit is attached hereto. 

64. told the FBI that Manafort moved from his former residence on Mount 

Vernon Circle (also in Alexandria, VA) to the Subject Premises in or around May of 2015, and 
that he ^impersonally helped Manafort move belongings from the former residence to the 
Subject Premises and to the aforementioned storage locker on 370 Holland Lane. also 

advised that the Subject Premises includes its own separate locked storage unit, which is used to 
store, among other things, miscellaneous items of furniture. The last time accessed the 

storage unit was in March or April 2017. 

65. H indicated that Manafort used his home to do business and maintained 

records of his businesses at his home. For instance, some of the material that was moved to Unit 
3013 included files from Manafort’s former residence on Mount Vernon Circle in Alexandria, 
Virginia. indicated that Manafort was using his former residence as an office at the time. 

also advised the FBI that company documentation was being kept at the Subject 
Premises. In particular, m informed the FBI that in late April or early May of 2017, m| 
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told him that she and Manafort were reorganizing their lives and as part of that process 
were getting documents ready for meetings with their attorney. At the same time, saw 

miscellaneous documents on , a coffee table at the Subject Premises, including but not limited to 
Federal Election Commission documents. 

66. also informed the FBI that one of the rooms in the Subject Premises is used 

as an office, and that has seen business records in that office, including in one or two 

drawers. Amo ng the records maintained in the drawers were records related to Manafort’s various 
business entities, including John Hannah LLC (as discussed in Paragraph 16 above) and, he 
believes, DMP International, LLC. 

67. In an interview with the FBI on July 19, 2017, ||[^B indicated that the last time 

he was inside the Subject Premises was on or about July 5, 2017, when he picked up Manafort’s 
mail and shipped a suit to another Manafort residence at Manafort’s request; and the last time he 
was at the Subject Premises was on or about July 11, 2017, when he took t° 

the airport. 

68. It is reasonable to believe that business records related to Manafort’s work in 

Ukraine, including historical records, would be maintained among the business files kept .at the 
Subject Premises, including the files kept for use in consulting with counsel. On June 27, 2017, 
Manafort, Gates, and DMP International, LLC registered under FARA for the years 2012-2014 as 
a result of their political work in Ukraine, having failed to do so previously. This registration 
followed a series of communications between Manafort, his counsel, and officials in the United 
States Department of Justice’s National Security Division (which administers the FARA 
registration process) about the FARA requirements. At least one of these communications, dated 
September 13, 2016, was directed to Manafort at m Alexandria, VA, 
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i.e., the Subject Premises. It is therefore reasonable to believe that records relating to this filing 
(and thus related to Manafort’s failure to file previously) are maintained at the Subject Premises, 
including records of Manafort’s work on behalf of the Party of Regions and payments received 
from them. Among other things, in the Gates Interview, Gates told the FBI that Manafort and he 
used “standard English” common law contracts for their Ukrainian work and would invoice the 
customer for payment. 9 

69. These records are particularly valuable since counsel for Manafort has informed the 
United States Department of Justice that at least as of November 23, 2016, DMP International, 
LLC purports to have an ‘‘Email Retention Policy” which results in its not retaining 
“communications beyond thirty days.” In spite of its title, the policy purports to cover not just 
email, but “information that is either stored or shared via electronic mail or instant messaging 
technologies, and documentation residing on any computer or server.” The policy also purports 
to provide that “[e]ach employee may at its [sic] discretion archive certain electronic information 
that pertains to the company’s business or mission,” but the the employee “must do so with the 
knowledge that all emails, electronic documents and other electronic material shall be deleted from 
corporate equipment, including but not limited to, computers, servers, and mobile devices, within 
30 days of possession of the information.” 

70. There is also probable cause to believe that the Subject Premises contains records 
related to Manafort’s efforts to secure loans from^^l on the basis of inconsistent representations 
about his income and net worth, as described above. Records obtained from|^H show that in 

9 In contrast, in their June 27, 2017, FAR A filings, Gates, Manafort, and DMP International, LLC 
indicated that there was no formal written contract of exchange of correspondence between the 
parties. In such circumstances, the FARA form requires the filer to “give a complete description” 
of the terms and conditions of the oral agreement or understanding, its duration, the fees and 
expenses, if any, to be received.” The June 2017 filings provide none of that information. 
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approximately August 2016, Manafort submitted bank statements for two accounts at Citi to | 
in connection with his application for lending. One of the two bank statements submitted to | 


is addressed to 


at the address of the Subject Premises. Bank records also show 


that beginning in December 2016, bank statements for the other account were directed to the same 
address. Accordingly, there is probable cause to believe that bank statements and other 


documentation related to those accounts, which formed part of the 
Manafort’s request for lending, could be found at the Subject Premises. 


consideration of 


71. Additionally, there is probable cause to believe that other financial records relevant 
to the Subject Offenses will be found at the Subject Premises. Manafort’s prior residence in 


Alexandria, 


I, was listed as the address of record for a number of 


accounts, including accounts at First Republic Bank in Chicago that were closed in 2014 following 
anti-money laundering concerns by the bank, as discussed in Paragraph 16 above. From my 
training and experience, I am aware that individuals and businesses often retain copies of financial 
records for several years, including in connection with tax filing obligations. Accordingly, and 
given the fact that Manafort and his wife moved to the Subject Premises from his prior residence 
in the same city in approximately May of 2015, it is reasonable to believe that financial records 
sent to his prior residence may be found at the Subject Premises. Additionally, a mail cover 
conducted by the FBI, involving the review of the outside cover of United States Postal Service 
(USPS) mail addressed to the Subject Premises, reveals that during the period between 
approximately June 13, 2017 and July 12, 2017, mail to the Subject Premises included, among 


other things, a first class mailing from| 


mail from M&T Bank, 


and a statement from American Express addressed to both Paul Manafort and “Davis Manafort 
Part,” which I believe to refer to Davis Manafort Partners. 
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72. Further, there is probable cause to believe that the Subject Premises contains 

physical evidence in the form of physical items purchased through the use of funds from foreign 
bank accounts, including from the Cypriot bank accounts described above. For instance, given 
that Manafort lives at the premises, there is probable cause to believe that men’s clothing and 
accessories purchased at one or both of the clothing vendors and paid for by wire transfers from 
various Cyprus accounts, as referenced in Paragraph 14 above, will be found at the Subject 
premises. Bank records and records obtained from the clothiers show that between 2009 and 2012, 
Manafort purchased more than approximately $760,000 in merchandise from these two clothiers 
using funds wired from several of the Cypriot accounts. Purchases included multiple suits and 
jackets in excess of $10,000 and at least one limited edition Bijan Black Titanium “Royal Way” 
watch, purchased for $21,000. Between approximately 2009 and spring 2015, invoices for 
Manafort’s purchases from^lHHI were sent t0 Manafort’s previous Alexandria residence 
on more recently, invoices have been sent to Manafort at the Subject 

Premises. According to m there are two closets at the Subject Premises that contain clothing 
and jewelry. 

73. There is also reason to believe that rugs purchased with funds from the Cypriot 

accounts would be found at the Subject Premises. Wire transfers totaling more than $360,000 
were sent from Cypriot accounts directly to a carpet store located in 

Alexandria, Virginia, near to the Subject Premises. The funds were used to pay for rugs acquired 
by Manafort. In an interview with the FBI, one of the owners advised that 

Manafort brought several of his purchases back to the store for cleaning, which remain at the store. 
It is reasonable to believe that the remaining rugs purchased by Manafort with funds funneled 
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through the Cypriot accounts will be found at the Subject Premises (to include Premises' storage 
unit). 

74. Although I submit that there is probable cause to seize the aforementioned rugs and 
clothing as fruits of the Subject Offenses, the FBI does not intend to seize those items. Rather, 
upon an authorized search of the Subject Premises, the FBI intends to identify and photograph 
those items. 

Computers, Electronic Storage, and Forensic Analysis 

75. As described in Attachment B, this application seeks permission to search for 
records that might be found on the Subject Premises, in whatever form they are found. One form 
in which the records might be found is data stored on a computer’s hard drive or other storage 
media. 10 Thus, the warrant applied for would authorize the seizure of electronic storage media or, 
potentially, the copying of electronically stored information, all under Rule 41(e)(2)(B). 

76. In a July 2017 interview, |mH advised the FBI that there is a Mac desktop 

computer on the desk in the office at the Subject Premises, which is used by Manafort. For a 
variety of reasons, copies of historical records and current records are also frequently stored on 
external hard drives, thumb drives, and magnetic disks. There is reasonable cause to believe such 
media may be contained in and among records of Manafort’s business and financial activity at the 
Subject Premises. FBI interviews of mm further confirm that Manafort has made widespread 
use of electronic media in the course of his business activity. For example, mHI told the FBI 
that Manafort had a drawer full of phones and electronic equipment at his old residence in Mount 
Vernon Square. At one point, Manafort gave a °f computers and directed BIH to 

10 A storage medium is any physical object upon which computer data can be recorded. Examples 
include hard disks, RAM, floppy disks, flash memory, CD-ROMs, and other magnetic or optical 
media. 
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have the drives wiped before giving them to charity. Manafort also, gave m several additional 
devices, both laptops and cellular phones. 

77. I submit that there is probable cause to believe that evidence of the Subject Offenses 
may be found on storage media located at the Subject Premises, including but not limited to a 
desktop computer, for at least the following reasons: 

a. Based on my knowledge, training, and experience, I know that computer files or 
remnants of such files can be recovered months or even years after they have been 
downloaded onto a storage medium, deleted, or viewed via the Internet. 

Electronic files downloaded to a storage medium can be stored for years at little 
or no cost. Even when files have been deleted, they can be recovered months or 
years later using forensic tools. This is so because when a person “deletes” a file 
on a computer, the data contained in the file does not actually disappear; rather, 
that data remains on the storage medium until it is overwritten by new data. 

b. Therefore deleted files, or remnants of deleted files, may reside in free space or 
slack space - that is, in space on the storage medium that is not currently being used 
by an active file -for long periods of time before they are overwritten. In addition, 
a computer’s operating system may also keep a record of deleted data in a “swap” 
or “recovery” file. 

c. Wholly apart from user-generated files, computer storage media - in particular, 

• computers’ internal hard drives - contain electronic evidence of how a computer 
has been used, what it has been used for, and who has used it. To give a few 
examples, this forensic evidence can take the form of operating system 
configurations, artifacts from operating system or application operation, file system 
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data structures, and virtual memory “swap” or paging files. Computer users 
typically do not erase or delete this evidence, because special software is typically 
required for that task. However, it is technically possible to delete this information. 

78. Forensic evidence. As further described in Attachment B, this application seeks 
permission to locate not only computer files that might serve as direct evidence of the crimes 
described on the warrant, but also for forensic electronic evidence that establishes how computers 
were used, the purpose of their use, who used them, and when. There is probable cause to believe 
that this forensic electronic evidence will be on any storage medium in the Subject Premises 
because: 

a. Data on the storage medium can provide evidence of a file that was once on the 
storage medium but has since been deleted or edited, or of a deleted portion of a 
file (such as a paragraph that has been deleted from a word processing file). Virtual 
memory paging systems can leave traces of information on the storage medium that 
show what tasks and processes were recently active. Web browsers, e-mail 
programs, and chat programs store configuration information on the storage 
medium that can reveal information such as online nicknames and passwords. 
Operating systems can record additional information, such as the attachment of 
peripherals, the attachment of USB flash storage devices or other external storage 
media, and the times the computer was in use. Computer file systems can record 
information about the dates files were created and the sequence in which they were 
created, although this information can later be falsified. 

b. As explained herein, information stored within a computer and other electronic 
storage media may provide crucial.evidence of the “who, what, why, when, 
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where, and how” of the criminal conduct under investigation, thus enabling the 
United States to establish and prove each element or alternatively, to exclude the 
innocent from further suspicion. In my training and experience, information 
stored within a computer or storage media (e.g., registry information, 
communications, images and movies, transactional information, records of 
session times and durations, internet history, and anti-virus, spyware, and 
malware detection programs) can indicate who has used or controlled the 
computer or storage media. This “user attribution” evidence is analogous to the 
search for “indicia of occupancy” while executing a search warrant at a residence. 
The existence or absence of anti-virus, spyware, and malware detection programs 
may indicate whether the computer was remotely accessed, thus inculpating or 
exculpating the computer owner. Further, computer and storage media activity 
can indicate how and when the computer or storage media was accessed or used. 
For example, as described herein, computers typically contain, information that 
log: computer user account session times and durations, computer activity 
associated with user accounts, electronic storage media that connected with the 
computer, and the IP addresses through which the computer accessed networks 
and the internet. Such information allows investigators to understand the 
chronological context of computer or electronic storage media access, use, and 
events relating to the crime under investigation. Additionally, some information 
stored within a computer or electronic storage media may provide crucial 
evidence relating to the physical location of other evidence and the suspect. For 
example, images stored on a computer may both show a particular location and 
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have geo location information incorporated into its file data. Such file data 
typically also contains information indicating when the file or image was created. 
The existence of such image files, along with external device connection logs, 
may also indicate the presence of additional electronic storage media (e.g., a 
digital camera or cellular phone with an incorporated camera). The geographic 
and timeline information described herein may either inculpate or exculpate the 
computer user. Last, information stored within a computer may provide relevant 
insight into the computer user’s state of mind as it relates to the offense under 
investigation. For example, information within the computer may indicate the 
owner’s motive and intent to commit a crime (e.g., internet searches indicating 
criminal planning), or consciousness of guilt (e.g., running a “wiping” program to 
destroy evidence on the computer or password protecting/encrypting such 
evidence in an effort to conceal it from law enforcement). 

c. A person with appropriate familiarity with how a computer works can, after 
examining this forensic evidence in its proper context, draw conclusions about 
how computers were used, the purpose of their use, who used them, and when. 

d. The process of identifying the exact files, blocks, registry entries, logs, or other 
forms of forensic evidence on a storage medium that are necessary to draw an 
accurate conclusion is a dynamic process. While it is possible to specify in 
advance the records to be sought, computer evidence is not always data that can 
be merely reviewed by a review team and passed along to investigators. Whether 
data stored on a computer is evidence may depend on other information stored on 
the computer and the application of knowledge about how a computer behaves. 
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Therefore, contextual information necessary to understand other evidence also 
falls within the scope of the warrant. 

e. Further, in finding evidence of how a computer was used, the purpose of its use, 
who used it, and when, sometimes it is necessary to establish that a particular 
thing is not present on a storage medium. For example, the presence or absence 
of counter-forensic programs or anti-virus programs (and associated data) may be 
relevant to establishing the user’s intent. 

79. Necessity of seizing or copying entire computers or storage media. In most cases, 
a thorough search of a premises for information that might be stored on storage media often 
requires the seizure of the physical storage media and later off-site review consistent with the 
warrant. In lieu of removing storage media from the premises, it is sometimes possible to make 
an image copy of storage media. Generally speaking, imaging is the taking of a complete 
electronic picture of the computer’s data, including all hidden sectors and deleted files. Either 
seizure or imaging is often necessary to ensure the accuracy and completeness of data recorded 
on the storage media, and to prevent the loss of the data either from accidental or intentional 
destruction. This is true because of the following: 

a. The time required for an examination. As noted above, not all evidence takes the 
form of documents and files that can be easily viewed on site. Analyzing 
evidence of how a computer has been used, what it has been used for, and who 
has used it requires considerable time, and taking that much time on premises 
could be unreasonable. As explained above, because the warrant calls for forensic 
electronic evidence, it is exceedingly likely that it will be necessary to thoroughly 
examine storage media to obtain evidence. Storage media can store a large 
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volume of information. Reviewing that information for things described in the 
warrant can take weeks or months, depending on the volume of data stored, and 
would be impractical and invasive to attempt on-site. 

b. Technical requirements . Computers can be configured in several different ways, 
featuring a variety of different operating systems, application software, and 
configurations. Therefore, searching them sometimes requires tools or knowledge 
that might not be present on the search site. The vast array of computer hardware 
and software available makes it difficult to know before a search what tools or 
knowledge will be required to analyze the system and its data on the Subject 
Premises. However, taking the storage media off-site and reviewing it in a 
controlled environment will allow its examination with the proper tools and 
knowledge. 

c. Variety of forms of electronic media. Records sought under this warrant could be 
stored in a variety of storage media formats that may require off-site reviewing 
with specialized forensic tools. 

80. Nature of examination. Based on the foregoing, and consistent with Rule 
41(e)(2)(B), the warrant I am applying for would permit seizing, imaging, or otherwise copying 
storage media that reasonably appear to contain some or all of the evidence described in the 
warrant, and would authorize a later review of the media or information consistent with the 
warrant. The later review may require techniques, including but not limited to computer-assisted 
scans of the entire medium, that might expose many parts of a hard drive to human inspection in 
order to determine whether it is evidence described by the warrant. 
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81. Based on the foregoing, I respectfully submit there is probable cause to believe that 
the Subject Offenses have been committed and that there is probable cause that evidence of the 
Subject Offenses, as described in Attachment B, is to be found at the Subject Premises. 

III. Conclusion and Ancillary Provisions 

82. Based on the foregoing, I respectfully request the Court to issue a warrant to search 

the Subject Premises, as described in Attachment A to this affidavit, and to seize the items and 

\ 

information specified in Attachment B. 

83. In light of the confidential and highly sensitive nature of the continuing 
investigation, I respectfully request that this affidavit and all papers submitted herewith be 
maintained under seal until the Court orders otherwise. 


Respectfully submitted, 



Special Agent 

Federal Bureau of Investigation 


Sworn to before me on . . 

July^, 2017 ~- -p -- 

_ Theresa Carroll Buchanan 

United States Magistrate Judge 
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ATTACHMENT A 
The Property to Be Searched 

The premises to be searched (the “Subject Premises”) is the condominium unit located at 

Alexandria, VA 22314, including the storage unit numbered^ 
H as well as any locked drawers, containers, cabinets, safes, computers, electronic devices, and 
storage media (such as hard disks or other media that can store data) found therein. 
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ATTACHMENT B 


Items to Be Seized (or, in the alternative, identified) 

1. Records relating to violations of 31 U.S.C. §§ 5314, 5322(a) (failure to file a report 

of foreign bank and financial accounts); 22 U.S.C. § 611, el. seq. (foreign agents registration act); 
26 U.S.C. § 7206(1) (filing a false tax return); 18 U.S.C. § 1014 (fraud in connection with the 
extension of credit); 18 U.S.C. §§ 1341, 1343, and 1349 (mail fraud, wire fraud, and conspiracy to 
commit these offenses); 18 U.S.C. §§ 1956 and 1957 (money laundering and money laundering 
conspiracy); 52 U.S.C. §§ 30121(a)(1)(A) and (a)(2) (foreign national contributions); and 18 
U.S.C. §§371 and 2 (conspiracy, aiding and abetting, and attempt to commit-such offenses) 
(collectively, the “Subject Offenses”), occurring on or after January 1, 2006, including but not 
limited to: 

a. Any and all financial records for Paul Manafort, Jr., |^^^H^^^^HRichard 

Gates, or companies associated with Paul Manafort, Jr!7^||||^^^BI|^B or 
Richard Gates, including but not limited to records relating to any foreign financial 
accounts and records relating to payments by or on behalf of any foreign 

government, foreign officials, foreign entities, foreign persons, or foreign 

principals; 

i 

b. Any and all federal and state tax documentation, including but not limited to 
personal and business tax returns and all associated schedules for Paul Manafort, 
Jr., Richard Gates, or companies associated with Manafort or Gates; 

c. Letters, correspondence, emails, or other forms of communications with any 
foreign financial institution, or any individual acting as the signatory or controlling 
any foreign bank account; 

d. Records relating to efforts by Manafort, Gates, or their affiliated entities to conduct 

activities on behalf of, for the benefit of, or at the direction of any foreign 

government, foreign officials, foreign entities, foreign persons, or foreign 

principals, including but not limited to the Party of Regions and Viktor 
Yanukovych; 

e. Records relating to, discussing, or documenting Telmar Investments Limited, 
Tiakora Ventures Limited, Lucicle Consultants Limited, Actinet Trading Limited, 
Black Sea View Limited, Bletilla Ventures Limited, Evo Holdings Limited, Global 
Highway Limted, Leviathan Advisors Limited, Loav Advisors Limited, Peranova 
Holdings Limited, including but not limited to bank records, canceled checks, 
money drafts, letters of credit, cashier’s checks, safe deposit records, checkbooks, 
and check stubs, duplicates and copies of checks, deposit items, savings passbooks, 
wire transfer records, and similar bank and financial account records; 

f. Physical items purchased through the use of funds from Cy priot accounts, including 

but not limited to rugs purchased from a Bijan Black Titanium 

“Royal Way” watch, and clothing purchased from HHHHHlHlHHHI 
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g. Evidence relevant to any false statements, pretenses, representations, or material 
omissions in connection with communications with the Department of Justice, the 
Internal Revenue Service, tax preparers, accountants, or banks; 

h. Communications, records, documents, and other fil es involving any of the 
attendees of the June 9, 2016 meeting at Trump tower, ^H 

i. Evidence indicating Manafort’s state of mind as it relates to the crimes under 
investigation; 

j. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with Manafort about any matters relating to 
activities conducted by Manafort on behalf of, for the benefit of, or at the direction 
of any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

k. Any and all daily planners, logs, calendars, or schedule books relating to Manafort 
or Gates. 

2. Computers or storage media used as a means to commit the Subject Offenses. 

3. For any computer or storage medium whose seizure is otherwise authorized by 
this warrant, and any computer or storage medium that contains or in which is stored records or 
information that is otherwise called for by this warrant (hereinafter, “COMPUTER”): 

a. evidence of who used, owned, or controlled the COMPUTER at the time the 
things described in this warrant were created, edited, or deleted, such as logs, 
registry entries, configuration files, saved usernames and passwords, 
documents, browsing history, user profiles, email, email contacts, “chat,” 
instant messaging logs, photographs, and correspondence; 

b. evidence of software that would allow others to control the COMPUTER, 
such as viruses, Trojan horses, and other forms of malicious software, as well 
as evidence of the presence or absence of security software designed to detect 
malicious software; 

c. evidence of the lack of such malicious software; 

d. evidence indicating how and when the computer was accessed or used to 
determine the chronological context of computer access, use, and events 
relating to crime under investigation and to the computer user; 

e. evidence indicating the computer user’s state of mind as it relates to,the crime 
under investigation; 

f. evidence of the attachment to the COMPUTER of other storage devices or 
similar containers for electronic evidence; 
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g. evidence of counter-forensic programs (and associated data) that are designed 
to eliminate data from the COMPUTER; 

h. evidence of the times the COMPUTER was used; 

i. passwords, encryption keys, and other access devices that may be necessary to 
access the COMPUTER; 

j. documentation and manuals that may be necessary to access the COMPUTER 
or to conduct a forensic examination of the COMPUTER; 

k. records of or information about Internet Protocol addresses used by the 
COMPUTER; 

l. records of or information about the COMPUTER’S Internet activity, including 
firewall logs, caches, browser history and cookies, “bookmarked” or 
“favorite” web pages, search terms that the user entered into any Internet 
search engine, and records of user-typed web addresses; 

m. contextual information necessary to understand the evidence described in this 
attachment. 

As used above, the terms “records” and “information” includes all forms of creation or 
storage, including any form of computer or electronic storage (such as hard disks or other media 
that can store data); any handmade form (such as writing); any mechanical form (such as printing 
or typing); and any photographic form (such as microfilm, microfiche, prints, slides, negatives, 
videotapes, motion pictures, or photocopies). 

The term “computer” includes all types of electronic, magnetic, optical, electrochemical, 
or other high speed data processing devices performing logical, arithmetic, or storage functions, 
including desktop computers, notebook computers, mobile phones, tablets, server computers, and 
network hardware. 

The term “storage medium” includes any physical object upon which computer data can 
be recorded. Examples include hard disks, RAM, floppy disks, flash memory, CD-ROMs, and 
other magnetic or optical media. 


3 


J 



